Search for vulnerabilities
Vulnerability details: VCID-7363-ze97-87et
Vulnerability ID VCID-7363-ze97-87et
Aliases CVE-2025-2559
GHSA-2935-2wfm-hhpv
Summary Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.9 https://access.redhat.com/errata/RHSA-2025:4335
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:4335
ssvc Track https://access.redhat.com/errata/RHSA-2025:4335
cvssv3.1 4.9 https://access.redhat.com/errata/RHSA-2025:4336
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:4336
ssvc Track https://access.redhat.com/errata/RHSA-2025:4336
cvssv3 4.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-2559.json
cvssv3.1 4.9 https://access.redhat.com/security/cve/CVE-2025-2559
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-2559
ssvc Track https://access.redhat.com/security/cve/CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2025-2559
cvssv3.1 4.9 https://bugzilla.redhat.com/show_bug.cgi?id=2353868
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2353868
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2353868
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2935-2wfm-hhpv
cvssv3.1 4.9 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 4.9 https://nvd.nist.gov/vuln/detail/CVE-2025-2559
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-2559
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:4335
https://access.redhat.com/errata/RHSA-2025:4336
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-2559.json
https://access.redhat.com/security/cve/CVE-2025-2559
https://api.first.org/data/v1/epss?cve=CVE-2025-2559
https://bugzilla.redhat.com/show_bug.cgi?id=2353868
https://github.com/keycloak/keycloak
https://nvd.nist.gov/vuln/detail/CVE-2025-2559
cpe:/a:redhat:build_keycloak:26 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26
cpe:/a:redhat:build_keycloak:26.0::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.0::el9
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
GHSA-2935-2wfm-hhpv https://github.com/advisories/GHSA-2935-2wfm-hhpv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2025:4335
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-31T16:31:49Z/ Found at https://access.redhat.com/errata/RHSA-2025:4335
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2025:4336
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-31T16:31:49Z/ Found at https://access.redhat.com/errata/RHSA-2025:4336
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-2559.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/security/cve/CVE-2025-2559
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-31T16:31:49Z/ Found at https://access.redhat.com/security/cve/CVE-2025-2559
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2353868
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-31T16:31:49Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2353868
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-2559
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.5041
EPSS Score 0.00272
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:07.891067+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-2935-2wfm-hhpv/GHSA-2935-2wfm-hhpv.json 37.0.0